See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/281333089

Power system reliability evaluation considering cyber-malfunctions in

substations

Article  in  Electric Power Systems Research · December 2015

DOI: 10.1016/j.epsr.2015.08.010

CITATIONS READS

24 618

2 authors:

Hangtian Lei C. Singh

University of Idaho Texas A&M University
19 PUBLICATIONS   207 CITATIONS    123 PUBLICATIONS   3,347 CITATIONS   

SEE PROFILE SEE PROFILE

Some of the authors of this publication are also working on these related projects:

Advanced Methods of Reliability Evaluation View project

RELIABILITY ASSESSMENT OF ELECTRIC POWER SYSTEMS USING GENETIC ALGORITHMS View project

All content following this page was uploaded by Hangtian Lei on 02 November 2017.

The user has requested enhancement of the downloaded file.

 Electric Power Systems Research 129 (2015) 160–169

Contents lists available at ScienceDirect

Electric Power Systems Research

journal homepage: www.elsevier.com/locate/epsr

Power system reliability evaluation considering cyber-malfunctions

in substations
Hangtian Lei ∗ , Chanan Singh
Department of Electrical and Computer Engineering, Texas A&M University, College Station, TX 77843, USA

a r t i c l e i n f o a b s t r a c t

Article history: Protection system failures have been recognized as major causes of expanded outages and thereby affect
Received 22 April 2015 bulk power system reliability. With the rapid progress of smart grid technologies, legacy protection
Received in revised form 3 August 2015 systems with hardwired architecture are being gradually replaced by computer and communication
Accepted 5 August 2015
networks consisting of multi-functional and smart Intelligent Electronic Devices (IEDs). In this paper, a
systematic methodology for considering the effect of cyber-malfunctions in substations on power sys-
Keywords:
tem reliability is proposed by extending the concepts we previously presented. The Roy Billinton Test
Cyber-physical interface matrix
System (RBTS) is extended to include substation protection systems with modern architecture, which
Hidden failure
Protection system
is an important step as a test system like this is currently unavailable. The proposed approach is then
Reliability demonstrated on this test system. The quantitative relationship between switching time and system-
Switching wide energy unavailability is studied. The results of our study clearly indicate the impact of protection
system failures on system-wide reliability indices and signify the importance of accelerating line switch-
ing process. Furthermore, the overall methodology used in this paper provides a tractable and scalable
option for the reliability evaluation of large cyber-physical power systems.
© 2015 Elsevier B.V. All rights reserved.

1. Introduction A protection system consists of circuit breakers, current and

voltage transformers, communication cables, protective relays,
The quantitative reliability indices of bulk power systems are and possibly some auxiliary devices [11–13]. With the advent of
important to utility companies, vendors, and regulators for plan- microprocessor-based relays and the rapid progress of communi-
ning, operation, maintenance, and regulatory purposes. Studies of cation technologies, modern protection panels are equipped with
bulk power system reliability evaluation have been mostly focusing multifunctional Intelligent Electronic Devices (IEDs) that are con-
on the current-carrying part. The pertinent theories and method- nected to communication networks [14–17].
ologies are well established and documented [1–3]. In composite power system reliability evaluation, due to the
In bulk power system reliability evaluation, protection systems variety of protection system architectures as well as the diversity
are typically assumed to be perfectly reliable so that the failure of a of control and communication mechanisms, it is hard to explic-
current-carrying component will result in the isolation of that com- itly model protection systems with detailed configurations. As a
ponent only. This assumption may neglect the impact of protection result, in most of the previous work, protection system failures
system failures on system-wide reliability indices. It has been rec- were either concentrated on circuit breaker trip mechanisms [6] or
ognized that protection system hidden failures are common causes represented abstractly by multistate models [7–10] without show-
of multiple or cascading outages [4–7]. Some studies [6–10] have ing the technical details regarding protection system elements as
been done to consider protection system failures and the results well as their connections. Due to the absence of such details, the
show that protection system failure modes have significant effects interdependencies between protection elements and power equip-
on evaluated reliability indices. ment were not covered in those publications. In [18,19], to study the
direct and indirect cyber-physical interdependencies, some math-
ematical terms and operations were defined and proposed with
applications on small test systems including monitoring, control,
and protection features. The results in [18,19] provide valuable
∗ Corresponding author. Tel.: +1 979 571 0474. information that indicates the impact of cyber element failures on
E-mail addresses: hlei7@tamu.edu (H. Lei), singh@ece.tamu.edu (C. Singh). physical system reliability indices. However, excessive self-defined

http://dx.doi.org/10.1016/j.epsr.2015.08.010
0378-7796/© 2015 Elsevier B.V. All rights reserved.
 H. Lei, C. Singh / Electric Power Systems Research 129 (2015) 160–169 161

reliability terms and tedious mathematical operations were intro- 2.1. Reliability analysis at the substation level
duced in [18,19]. These terms are hardly available from engineering
practice, making it difficult to implement the overall methodology The failure modes of protection systems in terms of basic cyber
in practical applications. Reference [20] proposed a more system- elements and their relationships to transmission line tripping sce-
atic and scalable methodology of performing the overall analysis in narios are analyzed in this stage. The CPIMs, which depict the
a tractable fashion with the use of Cyber-Physical Interface Matrix interdependencies among the failures of physical components due
(CPIM). In [20], a typical substation protection system with detailed to various cyber failure modes, are obtained at the end of this stage.
architecture was designed and analyzed as an example to illus-
trate the procedures of obtaining a CPIM. The steps on how to use 2.2. Reliability evaluation from the system-wide perspective
a CPIM in composite power system reliability evaluation were also
formulated. In this stage, a sequential Monte Carlo simulation is performed
The composite power system displayed in [20] is simple and is on the composite system to obtain system-wide reliability indices.
used for illustration only. The overall methodology with the use of The results of CPIMs obtained in the previous stage are directly
CPIM needs to be further demonstrated with its implementation on utilized in this stage without the necessity of considering protection
a standard test system so that the impact of protection failures on system configuration details. At the end of this stage, system-wide
system-wide reliability indices can be numerically validated. Also, reliability indices, such as Loss of Load Probability (LOLP), Loss of
the scalability of the overall methodology needs further illustration Load Expectation (LOLE), Expected Energy Not Supplied (EENS), and
as this is very important to its application for large power systems. Expected Frequency of Load Curtailment (EFLC), for each bus and
Moreover, the unavailability of standard reliability test systems for the overall system, can be obtained.
containing practical protection features is an obstacle for valida-
tion of the impact of protection failures on system-wide reliability 2.3. System-wide reliability indices
indices. The extension of the Roy Billinton Test System (RBTS) [21]
performed in this paper provides valuable information for develop- The following system-wide reliability indices [7,9,22] are
ing standard reliability test systems including protection features defined and used in this paper.
and will thereby benefit future studies in this area. With these
2.3.1. Loss of load probability (LOLP)
objectives, this paper continues and enhances the work that has Ns H t
i i
been performed in [20]. The remainder of this paper is organized LOLP = (1)
i=1 ttotal
as follows. Section 2 outlines the overall methodology. Section 3
presents the test system configuration and parameters. In Section where,
4, the overall analysis, including the reliability analysis at the sub- Ns is total number of iterations simulated;
station level and the reliability evaluation at the composite system Hi equals 1 if load curtailment occurs in the ith iteration; other-
level, is performed. Also, the results are presented and summarized. wise it equals 0;
The scalability of the overall methodology performed in this paper ti is simulated time in the ith iteration, with the unit of year; and
is illustrated in Section 5. Some major considerations in software ttotal is total simulated time, with the unit of year.
implementation for large power systems are discussed in Section
6. Finally, the conclusions are made in Section 7. 2.3.2. Loss of load expectation (LOLE)
LOLE = LOLP × 8760 (2)

with the unit of hours/year.

2. Methodology outline and objectives 2.3.3. Expected energy not supplied (EENS)
Ns 8760R t
i i
The cyber-physical interdependencies exist in many aspects of EENS = (3)
i=1 ttotal
power systems, including but not limited to supervisory control,
protection, monitoring, metering, etc. This paper focuses on the with the unit of MWh/year,
aspect of protection since protection hidden failures are recognized where,
as common causes of expanded outages and have significant impact Ns is total number of iterations simulated;
on power system reliability [4–10]. Ri is load curtailment during the ith iteration, with the unit of
In this paper, reliability evaluation is performed in a composite MW;
power system consisting of current-carrying components and pro- ti is simulated time in the ith iteration, with the unit of year; and
tection systems. The Roy Billinton Test System (RBTS) [21] is used ttotal is total simulated time, with the unit of year.
as the test system with extensions at load buses to include detailed
2.3.4. Expected frequency of load curtailment (EFLC)
configuration in terms of protection system elements. Ns Z
i
The size of this system is small to permit reasonable time for EFLC = (4)
i=2 ttotal
extension of cyber part and development of interface matrices but
the configuration of this system is sufficiently detailed to reflect with the unit of (/year),
the actual features of a practical system [22]. The methodology where,
performed in this paper also applies for large systems. For large sys- Ns is total number of iterations simulated;
tems, in spite of more efforts needed in detailed analysis of cyber Zi equals 1 if load curtailment does not happen in the (i − 1)th
failure modes as well as effects on the physical side, the main pro- iteration AND load curtailment happens at the ith iteration; other-
cedures are identical to those performed in this paper. In short, wise it equals 0; and
the selected system is adequate to illustrate the methodology and ttotal is total simulated time, with the unit of year.
extension to larger systems is more mechanical effort rather than
illustrating the validity of the technique. 3. Test system configuration
The overall analysis mainly consists of two stages: (1) reliabil-
ity analysis of protection systems at the substation level and (2) The Roy Billinton Test System (RBTS) [21] is used as the test
reliability evaluation from the system-wide perspective. system in this paper. The single line diagram of the RBTS is shown
162 H. Lei, C. Singh / Electric Power Systems Research 129 (2015) 160–169

G1 G5 ~ Table 3
~ G6
~ Transmission line physical parameters.

Line no. Buses Reactance X (p.u.) Current rating (p.u.)

~ G8
From To
~ G9 20 MW
3 1 1 3 0.180 0.85
Generating
Generating ~ G10 2 2 4 0.600 0.71
Station 1
Station 2 ~ G11 3 1 2 0.480 0.71
~ ~
4 3 4 0.120 0.71
G3 G4 5 3 5 0.120 0.71
6 1 3 0.180 0.85
6 7 2 4 0.600 0.71
~ 1 2
~ G7 7 8 4 5 0.120 0.71
G2 4
9 5 6 0.120 0.71

Load Load
Bus 3 Bus 4 power flow model is used in case of load curtailment. Therefore,
only the real power data are considered.

5 8
3.1.1. Generation variation
85 MW 40 MW The generators are represented by reliability models with two
states, up and down. The corresponding failure rate and Mean
Load Repair Time (MRT) are obtained from [21] and are tabulated in
Bus 5
20 MW Table 2.

9 3.1.2. Load variation

The annual peak load data for each bus are obtained from [21]
Load and are shown in Table 1. The hourly load profile is created based
Bus 6
on the information in Tables 1–3 of the IEEE Reliability Test System
[23].

20 MW
3.2. Transmission line data
Fig. 1. Single line diagram of the RBTS.
The transmission line physical parameters and outage data are
Table 1
obtained from [21] and are tabulated in Tables 3 and 4, respectively.
Bus data. A DC optimal power flow model with simplified line parameters
is used in case of load curtailment. Therefore, the line resistance (R)
Bus no. Name in Fig. 1 Peak load (p.u.) Generation capacity (p.u.)
as well as the charging susceptance (B) are not considered in the
1 Generating station 1 0.00 1.10 transmission line model and only the line reactance (X) is provided
2 Generating station 2 0.20 1.30
in Table 3. Furthermore, in the DC optimal power flow model, since
3 Load bus 3 0.85 0
4 Load bus 4 0.40 0 the voltage magnitude at each bus is assumed to be 1.0 p.u., the
5 Load bus 5 0.20 0 current rating for each line shown in Table 3 is numerically equal
6 Load bus 6 0.20 0 to the power rating.
For the transmission line outage data, compared with [21], the
transient outage (normally with duration of less than one minute)
in Fig. 1. The bus, generation, load, and transmission line data are is not considered in this paper. Instead, a new term switching time
also provided in this section. In this paper, 100 MVA and 230 kV are is defined. The switching time for each transmission line, which
used as the base values of power and voltage. is tabulated in Table 4, defines the time needed to switch a line
back to service when this line is tripped due to a protection failure
3.1. Bus, generation, and load data rather than resulting from a primary fault occurs at this line. The
reciprocal of a switching time is called a switching rate and has been
The data for all the buses and generating units are obtained from illustrated in [20].
[21] and are tabulated in Tables 1 and 2, respectively. A DC optimal

Table 4
Table 2 Transmission line outage data.
Generating unit data.
Line no. Buses Permanent outage Outage duration Switching
Unit no. Bus Rating (MW) Failure rate (/year) MRT (h) rate (/year) (h) time (h)
1 1 40 6.0 45
From To
2 1 40 6.0 45
3 1 10 4.0 45 1 1 3 1.5 10.0 4.0
4 1 20 5.0 45 2 2 4 5.0 10.0 4.0
5 2 5 2.0 45 3 1 2 4.0 10.0 4.0
6 2 5 2.0 45 4 3 4 1.0 10.0 4.0
7 2 40 3.0 60 5 3 5 1.0 10.0 4.0
8 2 20 2.4 55 6 1 3 1.5 10.0 4.0
9 2 20 2.4 55 7 2 4 5.0 10.0 4.0
10 2 20 2.4 55 8 4 5 1.0 10.0 4.0
11 2 20 2.4 55 9 5 6 1.0 10.0 4.0
 H. Lei, C. Singh / Electric Power Systems Research 129 (2015) 160–169 163

Line 6 Line 5 Line 4 Line 1 Line 5 Line 8

Load 5
MU MU MU MU MU MU
3-6 3-7 3-8 3-9 5-5 5-6

3-1 3-2 3-3 5-1 5-2

MU MU MU MU MU
3-1 3-2 3-3 5-1 5-2

3-4 3-5
5-3 5-4

MU MU
3-4 3-5 MU MU MU
5-3 5-7 5-4

Load 3
Line 9

Process Bus
Process Bus

Line 1 Line 4 Line 5 Line 6

Protection Protection Protection Protection
Panel Panel Panel Panel Line 5 Line 8 Line 9
Protection Protection Protection
Panel Panel Panel
Fig. 2. The protection system for bus 3.
Fig. 4. The protection system for bus 5.

3.3. Protection system architecture and reliability data

For bus 6, since it is connected with only one transmission line

(line 9), even if its own protection system fails, line 9 will always
be de-energized by opening the breakers at bus 5 without isolating
any other lines. Therefore, the protection system configuration at
Fig. 5. State transition diagram of individual element.
bus 6 is not considered and only buses 3, 4, and 5 in the RBTS are
extended to include detailed protection system configurations, as
shown in Figs. 2, 3 and 4 respectively. in Table 5. We assume that a same type of elements at different
The reliability data for Circuit Breakers (CBs), Merging Units substations are identical and thereby have the same reliability data.
(MUs), Process Buses (PBs), and Line Protection Panels are tabulated According to engineering practice, the Mean Time to Failure
(MTTF) varies for Circuit Breakers at different voltage levels, or
serving different functions in the system [24]. For the study in this
Line 2 Line 8 Line 4 Line 7 paper, a typical value of 100 years is chosen for the MTTF and a
MU MU MU MU
value of 8 h is used for the Mean Repair Time (MRT).
4-6 4-7 4-8 4-9 The reliability data for MUs, PBs, and Line Protection Panels are
reasonably chosen based on the information from [14,25–27].
In this study, only two states, UP and DOWN, are considered for
4-1 4-2 4-3
each protection system element (except the process bus) listed in
Table 5. The state transition diagram is shown in Fig. 5. The failure
MU
4-1
MU
4-2
MU
4-3
and repair rates are denoted by  and , respectively.
The exponential distribution is assumed for state residence
times of each element, the probabilities of UP and DOWN can be
calculated using Eqs. (5) and (6), respectively.

pUP = (5)
4-4 4-5
+


MU MU pDOWN = (6)
4-4 4-5
+
Load 4
Table 5
Reliability data for protection system elements.
Process Bus
Element name MTTF (year) Failure rate MRT (h) Repair rate
 (/year)  (/year)
Line 2 Line 4 Line 7 Line 8 CB 100 0.01 8 1095
Protection Protection Protection Protection
MU 50 0.02 8 1095
Panel Panel Panel Panel
PB 100 0.01 8 1095
Line protection panel 50 0.02 8 1095
Fig. 3. The protection system for bus 4.
164 H. Lei, C. Singh / Electric Power Systems Research 129 (2015) 160–169

This paper improves the CPIM that was described in [20] by

eliminating the off-diagonal zeros to make it more compact. In this
paper, each row in a CPIM represents a physical component (trans-
mission line). Each column provides the probability of a consequent
Fig. 6. State transition diagram of the process bus.
event given that a primary fault occurred on this physical compo-
nent. Therefore, the probabilities in each row sum up to 1. If the
protection system is perfectly reliable, then the first column would
For the Process Bus (PB), an additional state representing DELAY have probabilities 1 and other columns zero.
is included as shown in Fig. 6. The probability of delay given that In addition, another matrix, Consequent Event Matrix (CEM),
the PB is not in the DOWN state is denoted by pd (=0.003). The is developed in accordance with a CPIM. A CEM provides detailed
illustration of this reliability model as well as the discussion regard- information about consequent events in which some lines go out
ing delay issues in substation communication networks have been of service while some are not affected. In a CEM, each event is
presented in [20]. coded as a 12-digit binary number, of which the left 9 digits corre-
Therefore, for the Process Bus, spond to the 9 transmission lines and the last 3 digits correspond
 to load branches 3, 4, and 5, respectively. A “1” digit indicates
pUP.PB = (1 − pd ) (7)
+ the corresponding component is going out of service whereas a
 “0” means this component is not affected. For example, an entry
pDELAY.PB = p (8) “100001100110” denotes a consequent event in which line 1, line
+ d
6, line 7, load branch 3, and load branch 4 are going out of service. A
 complete row of a CEM summarizes all possible consequent events
pDOWN.PB = (9)
+ when a primary fault occurs at this transmission line.
To illustrate how the malfunctions of cyber elements affect
In reality, the process bus is a network consisting of basic ele-
transmission line tripping behaviors, the detailed analysis for
ments that are connected with each other in various topologies and
the consequent events resulting from cyber element failures at
thus more sophisticated technical details are involved [26,28–31].
substation (bus) 3 following a primary fault occurs at line 1 is
The consideration of these technical details in composite system
shown below as an example. The analysis for the primary faults
reliability evaluation is beyond the scope of this paper and will be
at other lines can be performed similarly. In the analysis, the fail-
developed in our future work.
ure modes of individual cyber elements are assumed independent
The assumptions regarding other protection elements such as
since they are located in different units in a substation. There-
Current Transformers (CTs)/Potential Transformers (PTs), cable
fore, the probability of a consequent event can be obtained by
links, etc. and protection issues such as backup tripping follow
multiplying the probabilities of individual element states in this
those stated in [20]. The CTs, PTs, and cable links are assumed not to
event.
fail. In addition, based on the features of this particular test system,
Suppose a primary fault occurs at line 1, all possible consequent
several more assumptions are made:
events can be categorized as follows.
(1) All protection elements operate as intended.
a. The failure of an MU that is connected to a PT will result in If all protection elements operate as intended, then only line 1
the failure of acquired voltage information and thus will disable will be isolated. The action of line 1 tripping associated with these
the primary protection of this line. As a result, multiple break- elements at substation 3: MU 3-9, CB 3-3, MU 3-3, CB 3-5, MU 3-5,
ers associated with the primary protection will fail to trip and Process Bus, and Line 1 Protection Panel. Multiply the UP proba-
backup protections will be triggered. For example, in the bus 3 bilities of all these elements, the corresponding probability of this
protection system (shown in Fig. 2), if a primary fault happens consequent event can be obtained, which is 0.996899850569.
at Line 6 but MU 3-6 fails, then the Line 6 Protection Panel will (2) The Process Bus (PB) fails.
fail to issue trip signals to both breakers 3-1 and 3-4. As a result, If the PB fails, then the entire substation will be affected by
backup protection zones will be triggered and breakers 3-2 and this fault. All lines connected to this substation will be isolated by
3-5 will trip to isolate Line 6. tripping the breakers at remote substations. The corresponding
b. Since this paper focuses on transmission system reliability eval- probability of this consequent event can be calculated using Eq.
uation and the details of a load branch can be extended in the (9). This is an extreme case therefore the probability is very low.
distribution system. Primary faults that occur at load branches However, once this event happens, the impact is tremendous.
are not considered in this paper. However, the isolation of a load (3) One or both of MU 3-3, CB 3-3 fail(s), while all other associ-
branch resulting from undesired trips due to primary faults that ated elements operate as intended.
occur at adjacent transmission lines will be considered. In this case, CB 3-3 fails to trip while CB 3-5 trips as intended.
The fault will be cleared by opening CB 3-2 and CB 3-5. As a result,
4. Reliability analysis Lines 1 and 4 will be isolated.
(4) One or both of MU 3-5, CB 3-5 fail(s), while all other associ-
The overall analysis mainly consists of two stages: the reliabil- ated elements operate as intended.
ity analysis of protection systems at the substation level and the In this case, CB 3-5 fails to trip while CB 3-3 trips as intended.
reliability evaluation from the system-wide perspective. The CPIM, The fault will be cleared by opening CB 3-3 and CB 3-4. As a result,
which bridges the two stages, is a critical idea of this methodology. Line 1 and load branch 3 will be isolated.
It decouples the analysis of protection systems from the evalua- (5) The Process Bus (PB) does not fail, but both CB 3-3 and CB
tion of the composite system and makes the overall analysis more 3-5 fail to trip due to various combinations of element states, such
tractable. as Line 1 Protection Panel fails or the PB is in a DELAY state.
In this case, the fault will be cleared by opening CB 3-2 and CB
4.1. Substation level reliability analysis 3-4. As a result, Line 1, Line 4, and load branch 3 will be isolated.
The results of all the 5 cases above are summarized in the first
The substation level reliability analysis follows the procedures row of Table 6 and Table 7. It should be noted that these conse-
described in [20] with the objective of obtaining CPIMs. quent events are the results from cyber element failures. If the all
 H. Lei, C. Singh / Electric Power Systems Research 129 (2015) 160–169 165

Table 6
The cyber-physical interface matrix for bus 3.

Fault location Probabilities

Line 1 0.996899850569 0.000009132337 0.000027312491 0.000027312491 0.003036392112

Line 4 0.996899850569 0.000009132337 0.000027312491 0.000027312491 0.003036392112
Line 5 0.996899850569 0.000009132337 0.000027312491 0.000027312491 0.003036392112
Line 6 0.996899850569 0.000009132337 0.000027312491 0.000027312491 0.003036392112

Table 7
The consequent event matrix for bus 3.

Fault location Events

Line 1 100000000000 100111000000 100100000000 100000000100 100100000100

Line 4 000100000000 100111000000 000110000000 100100000000 100110000000
Line 5 000010000000 100111000000 000011000000 000110000000 000111000000
Line 6 000001000000 100111000000 000001000100 000011000000 000011000100

Table 8
The cyber-physical interface matrix for bus 4.

Fault location Probabilities

Line 2 0.996899850569 0.000009132337 0.000027312491 0.000027312491 0.003036392112

Line 4 0.996899850569 0.000009132337 0.000027312491 0.000027312491 0.003036392112
Line 7 0.996899850569 0.000009132337 0.000027312491 0.000027312491 0.003036392112
Line 8 0.996899850569 0.000009132337 0.000027312491 0.000027312491 0.003036392112

associated cyber elements are perfectly reliable, then the first case to determine the time of their next transitions. Appropriate
would have probability one while all other cases zero. transition rates should be used according to situations.
Following similar procedures performed above, the complete e. Evaluate system state: Perform the network power flow analysis
Cyber-Physical Interface Matrices (CPIMs) and Consequent Event to assess system operation states. Update reliability indices.
Matrices (CEMs) for buses 3, 4, and 5 are obtained and are shown f. Repeat steps b–e until convergence is achieved.
from Tables 6–11.
In step e, the following DC power flow linear programming
4.2. System-wide reliability evaluation model [33–35] is used with the objective of minimizing total load
Nb

The next event sequential Monte Carlo simulation [32] forms curtailment.Objective: y = Min Ci
the main framework for the reliability evaluation in this stage. The i=1
detailed steps, including illustrations on how to utilize the results subject to:
of a CPIM in the composite system reliability evaluation [20], are
summarized as follows. B̂ + G + C = L
G ≤ Gmax
a. Initialize. C≤L
b. Determine a primary event: Find the minimum time to the next DA ≤ F max
event, update the corresponding element’s state, and update the (10)
total time. −DA ≤ F max
c. Determine consequent events: If the state change in step b indi-
G, C ≥ 0
cates a primary fault occurring at a transmission line, then use
1 = 0
CPIMs and CEMs to determine the consequent events and update
elements’ states accordingly. If a CPIM row corresponding to this 2...Nb unrestricted
transmission line has n consequent events, the probabilities of
these events (p1 , p2 , . . ., pn ) sum up to 1. Draw a random number where,
ranging from 0 to 1. The value of this random number determines Nb is number of buses;
which consequent event is going to happen. It should be noted C is an Nb × 1 vector of bus load curtailments;
that a transmission line connects two substations. Therefore, two Ci is load curtailment at bus i;
random numbers should be drawn independently to determine B̂ is an Nb × Nb augmented node susceptance matrix;
the consequent event at each substation. G is an Nb × 1 vector of bus actual generating power;
d. Effects of switching and repair: For elements whose states have Gmax is an Nb × 1 vector of bus maximum generating availability;
been changed in step b or in step c, draw new random numbers L is an Nb × 1 vector of bus loads;

Table 9
The consequent event matrix for bus 4.

Fault location Events

Line 2 010000000000 010100110000 010000000010 010000010000 010000010010

Line 4 000100000000 010100110000 000100010000 000100100000 000100110000
Line 7 000000100000 010100110000 000100100000 000000100010 000100100010
Line 8 000000010000 010100110000 010000010000 000100010000 010100010000
166 H. Lei, C. Singh / Electric Power Systems Research 129 (2015) 160–169

Table 10
The cyber-physical interface matrix for bus 5.

Fault location Probabilities

Line 5 0.996899850569 0.000009132337 0.000027312491 0.000027312491 0.003036392112

Line 8 0.996899850569 0.000009132337 0.000027312491 0.000027312491 0.003036392112
Line 9 0.996899850569 0.000009132337 0.000027312491 0.000027312491 0.003036392112

Table 11
The consequent event matrix for bus 5.

Fault location Events

Line 5 000010000000 000010011000 000010001000 000010000001 000010001001

Line 8 000000010000 000010011000 000000010001 000000011000 000000011001
Line 9 000000001000 000010011000 000000011000 000010001000 000010011000

Table 12 To make a comparison, the situation in which protection sys-

Reliability indices for buses.
tems are assumed perfectly reliable is also simulated with results
LOLP LOLE (h/year) EENS (MWh/year) EFLC (/year) tabulated in Table 14. The comparison is also displayed in Fig. 7.
Bus 1 0 0 0 0 The results in Tables 13 and 14 show that protection system
Bus 2 0.00015926 1.395 2.655 0.260 malfunctions have significant impact on energy unavailability even
Bus 3 0.00017063 1.495 8.597 0.300 though they do not have much impact on individual line failure
Bus 4 0.00019288 1.690 10.095 0.315 rates. Compared with not considering protection malfunctions, the
Bus 5 0.00016786 1.470 3.729 0.275
percentage increment of the EENS for individual buses can be quite
Bus 6 0.00124176 10.878 116.104 1.305
Overall system 0.00128584 11.264 141.180 1.395 significant.
The effects of protection system malfunctions on EENS are
noticeable for buses 3, 4, and 5, with increments of 204.00%,
417.69%, and 73.85%, respectively. These three buses are also the
D is an Nt × Nt diagonal matrix of transmission line susceptances,
ones in which we have modeled and considered protection sys-
with Nt the number of transmission lines;
tem malfunctions. This further points to the impact of protection
A is an Nt × Nb line-bus incidence matrix;
malfunctions on energy unavailability.
 is an Nb × 1 vector of bus voltage angles; and
Fmax is an Nt × 1 vector of transmission line power flow capaci-
ties. 4.4. The effects of switching time
In Eq. (10), the variables are vectors , G, and C. Thus, the total
number of variables is 3Nb . This problem can be solved by using the A value of 4.0 h is assumed as the switching time for all trans-
linprog function provided in MATLAB software. mission lines and this value has been used in all previous analysis.
The convergence is measured by the coefficient of variation of a In engineering practice, a switching process may be accelerated
chosen index, as defined in [22]. A simulation with 200 simulated with the aid of smart grid technologies, or may be prolonged due
years is performed and the coefficient of variation for the system to other factors. The quantitative relationship between switching
EENS drops below 5%. time and system EENS are studied and the results are shown in
Table 15. In each case, same value of switching time is assumed for
all transmission lines and the system EENS is compared with the
4.3. Results and discussions case in which the switching time is 4.0 h. This relationship is also
displayed in Fig. 8.
The simulation results of LOLP, LOLE, EENS, and EFLC for each bus The information in Table 15 and Fig. 8 indicates a close rela-
and for the overall system are tabulated in Table 12. The simulated tionship between the line switching time and the system EENS.
transmission line failure rates due to primary faults and protec- The value of system EENS increases considerably with prolonged
tion system malfunctions are tabulated in Table 13. In Table 13, for switching time. This also signifies the importance of using advanced
line 3, the simulated line failure rate due to protection system mal- technologies with which the process of fault location and cyber fail-
functions equals 0. This is because line 3 links bus 1 to bus 2 and ure identification would be accelerated so that healthy lines can be
protection malfunctions are not considered for either of the two switched back to service more promptly.
buses.

Table 14
Table 13 EENS comparison.
Simulated transmission line failure rates.
EENS (MWh/year)  (%)
Line no. Failure rate resulting from Failure rate resulting from
primary faults (/year) protection malfunctions If protection systems Considering protection
(/year) are perfectly reliable malfunctions

1 1.455 0.010 Bus 1 0 0 N/A

2 4.850 0.005 Bus 2 1.862 2.655 42.59
3 3.870 0 Bus 3 2.828 8.597 204.00
4 1.030 0.075 Bus 4 1.950 10.095 417.69
5 0.925 0.010 Bus 5 2.145 3.729 73.85
6 1.570 0.010 Bus 6 103.947 116.104 11.70
7 5.100 0.005 Overall system 112.732 141.180 25.24
8 1.080 0.010 For each row,  is defined as the percentage increment of the EENS from not con-
9 1.030 0.010 sidering to considering protection malfunctions.
 H. Lei, C. Singh / Electric Power Systems Research 129 (2015) 160–169 167

Fig. 7. EENS comparison at each bus.

the framework of the overall methodology. It should be noted that

although in this stage, the analysis is needed for each individual
substation, with more experience in the analysis at substation
level, it may be possible to generate classifications into types of
substations and thus expedite the process.
Once the CPIMs and CEMs are established in the first stage, they
can be permanently stored and can be directly plugged into the reli-
ability evaluation in the second stage. The Monte-Carlo simulation
performed in the second stage is generic and applicable for large
power systems.The CPIM decouples the first stage of analysis from
the second stage and makes the overall analysis more tractable.

6. Considerations in software implementation for large

power systems
Fig. 8. Relationship between switching time and system EENS.

The methodology proposed in this paper establishes a

5. The scalability of the overall methodology framework for power system reliability evaluation considering
cyber-malfunctions in substations. Some implementation consid-
As shown in Section 4, the overall methodology consists of two erations are important to its application for large power systems.
stages: This section discusses two major considerations, the CPU time for
Monte Carlo simulation and the storage of matrices. At the outset
1. Reliability analysis at the substation level (i.e., the work per- we can say that some implementation issues will need to be worked
formed in Section 4.1). out but there do not appear to be any insurmountable barriers.
2. System-wide reliability evaluation (i.e., the work performed in
Section 4.2).
6.1. CPU time for Monte Carlo simulation
In the first stage, the detailed analysis depends on the actual
protection architecture of a substation. The analysis may seem The convergence in a Monte Carlo simulation is measured by
to be tedious for a substation with complex architecture. How- the coefficient of variation of a chosen index. In this paper, simu-
ever, the analysis in this stage can be performed locally at each lation is performed for 200 years and the coefficient of variation
substation and the computations can be performed offline. The for the system EENS drops below 5%. The simulation for this paper
increased workload for more complex substations does not change is performed in MATLAB running on a computer with a 3.10 GHz
processor and the running time for a simulation is approximately
Table 15
8 min. It should be noted that this software implementation of
Effect of switching time on system EENS. the simulation is only research grade to illustrate the concept and
is therefore not the most efficient as far as the running time is
Switching time (h) System EENS Percentage increment/decrement
concerned. The running time is largely consumed by the linprog
(MWh/year) compared with the value of
141.180 MWh/year in Table 14 function in MATLAB for DC power flow based linear programming
to evaluate system operation states. In the development of a com-
0.2 115.089 −18.48
0.5 120.941 −14.34 mercial grade program, the running time can be drastically reduced
1 126.945 −10.08 by several means as described below.
2 132.675 −6.02
4 141.180 0
10 157.615 +11.64 1. The linear programming incorporating DC power flow can be
24 178.986 +26.78 performed less frequently with the use of heuristic algorithms
48 190.628 +35.02 for screening, thus reducing the CPU time.
168 H. Lei, C. Singh / Electric Power Systems Research 129 (2015) 160–169

2. Simulation can be custom coded in more efficient programming The methodology implemented in this paper is scalable and pro-
languages. Custom programs are generally more efficient than vides an option for the reliability evaluation of large cyber-physical
generic ones coded in MATLAB. power systems. For such systems, in spite of more efforts needed
3. Much more efficient methods such as interior point methods can in detailed analysis, the main procedures remain similar to those
be used for linear programming. performed in this paper.
4. Monte Carlo simulation is readily amenable to parallel and dis-
tributed processing environments [36,37] to reduce the CPU Acknowledgments
time.
This paper was made possible by the Power Systems Engineering
It is important to mention that Monte Carlo simulation has Research Center (PSERC) under the grant “Reliability Assessment
already been successfully used for large composite power systems and Modeling of Cyber Enabled Power Systems with Renewable
but without considering the cyber-malfunctions. The contribu- Sources and Energy Storage (T-53)” and by NPRP grant # NPRP
tion of this paper is to develop a methodology to include cyber 7-106-2-053 from the Qatar National Research Fund (a member
induced dependent failures in such Monte Carlo programs. The of Qatar Foundation). The statements made herein are solely the
cyber induced dependent failures can be included in Monte Carlo responsibility of the authors.
simulation by using CPIMs. This does not significantly alter the
number of times linear programming is called for and thus does References
not alter the CPU time much.
[1] R. Billinton, Power system reliability evaluation, Gordon and Breach, New York,
1970.
6.2. Storage of matrices [2] R. Billinton, R.N. Allan, Reliability assessment of large electric power systems,
Kluwer, Boston, 1988.
[3] R. Billinton, W. Li, Reliability assessment of electric power systems using Monte
For a given power system, let m be the total number of rows in Carlo methods, Plenum Press, New York, 1994.
all CPIMs (or CEMs), n be the number of columns in a CPIM (or a [4] A.G. Phadke, J.S. Thorp, Expose hidden failures to prevent cascading outages,
IEEE Comput. Appl. Power 9 (3) (1996) 20–23.
CEM). [5] D.C. Elizondo, J. De La Ree, A.G. Phadke, S. Horowitz, Hidden failures in protec-
The value of m depends on the number of transmission lines. tion systems and their impact on wide-area disturbances, Proceedings of IEEE
The number of transmission lines in an actual power system is typ- power engineering society winter meeting, January/February 2001, vol. 2, pp.
710–714.
ically 1.2–2 times of the number of buses. Each transmission line [6] F. Yang, A.P.S. Meliopoulos, G.J. Cokkinides, Q.B. Dam, Effects of protection sys-
contributes a row in two CPIMs (or CEMs) corresponding to both of tem hidden failures on bulk power system reliability, Proceedings of the 38th
the two buses it connects to. Consider a power system with 1000 IEEE North American power symposium, September 2006, pp. 517–523.
[7] X. Yu, C. Singh, A practical approach for integrated power system vulnerability
buses (substations), which is a typical size of an actual transmission analysis with protection failures, IEEE Trans. Power Syst. 19 (November (4))
grid, it is reasonable to estimate the number of transmission lines (2004) 1811–1820.
as 2000 and thus the value of m is estimated to be 4000. [8] R. Billinton, J. Tatla, Composite generation and transmission system adequacy
evaluation including protection system failure modes, IEEE Trans. Power App.
The value of n is determined by the row with maximum number
Syst. PAS-102 (June (6)) (1983) 1823–1830.
of consequent events, which depends on the transmission line hav- [9] M.C. Bozchalui, M. Sanaye-Pasand, M. Fotuhi-Firuzabad, Composite system reli-
ing maximum number of adjacent lines. Assuming a transmission ability evaluation incorporating protection system failures, Proceedings of the
line has maximum 10 adjacent lines, thus the maximum possi- 2005 IEEE Canadian conference on electrical and computer engineering, May
2005, pp. 486–489.
ble value of n is 210 , which is 1024. Of course, it is possible that [10] K. Jiang, C. Singh, New models and concepts for power system reliability evalua-
a few transmission lines may have more than 10 adjacent lines. tion including protection system failures, IEEE Trans. Power Syst. 26 (November
For such lines, only the 1024 most likely consequent events are (4)) (2011) 1845–1855.
[11] S.H. Horowitz, A.G. Phadke, Power system relaying, 3rd ed., John Wiley & Sons
considered since the remaining consequent events have negligible Ltd, Chichester, West Sussex, UK, 2008.
probabilities. Thus, it is reasonable to estimate n as 1024. [12] J.L. Blackburn, T.J. Domin, Protective relaying: principles and applications, 3rd
Each entry in a CPIM can be stored as a 64-bit double-precision ed., CRC, Boca Raton, FL, USA, 2007.
[13] P.M. Anderson, Power System Protection—Part VI: reliability of protective sys-
floating-point number. Therefore, the total storage space needed tems, McGraw-Hill/IEEE Press, New York, 1999.
for all CPIMs is 8·m·n Bytes, which equals 31.25 MB (32,768,000 [14] B. Kasztenny, J. Whatley, E.A. Udren, J. Burger, D. Finney, M. Adamiak, Unan-
Bytes). swered questions about IEC 61850—what needs to happen to realize the vision?
Presented at the 32nd annual western protective relay conference, Spokane,
Each entry in a CEM is a binary number corresponding to a con- WA, USA, October 2005.
sequent event. For a system with 2000 transmission lines, 2000 bits [15] T. Skeie, S. Johannessen, C. Brunner, Ethernet in substation automation, IEEE
are needed to represent such an event. Thus, each entry uses 250 Control Syst. Mag. 22 (June (3)) (2002) 43–51.
[16] T.S. Sidhu, P.K. Gangadharan, Control and automation of power system substa-
Bytes (2000 bits) and the total storage space needed for all CEMs is
tion using IEC 61850 communication, Proceedings of the 2005 IEEE conference
250·m·n Bytes, which equals 976.5625 MB (1,024,000,000 Bytes). on control applications, August 2005, pp. 1331–1336.
Therefore, the total space needed to store all CPIMs and CEMs is [17] J.D. McDonald, Electric power substations engineering, 3rd ed., CRC, Boca Raton,
estimated to be 1007.8125 MB, which is approximately 0.9842 GB. FL, USA, 2012.
[18] B. Falahati, Y. Fu, L. Wu, Reliability assessment of smart grid considering direct
It is feasible to claim such space on hard drive or Random Access cyber-power interdependencies, IEEE Trans. Smart Grid 3 (September (3))
Memory (RAM). (2012) 1515–1524.
[19] B. Falahati, Y. Fu, Reliability assessment of smart grids considering indirect
cyber-power interdependencies, IEEE Trans. Smart Grid 5 (July (4)) (2014)
1677–1685.
7. Conclusions [20] H. Lei, C. Singh, A. Sprintson, Reliability modeling and analysis of IEC 61850
based substation protection systems, IEEE Trans. Smart Grid 5 (September (5))
In this paper, a systematic reliability evaluation methodol- (2014) 2194–2202.
[21] R. Billinton, S. Kumar, N. Chowdhury, K. Chu, K. Debnath, L. Goel, E. Khan, P.
ogy is implemented in a composite power system consisting of Kos, G. Nourbakhsh, J. Oteng-Adjei, A reliability test system for educational
current-carrying components and protection systems with modern purposes-basic data, IEEE Trans. Power Syst. 4 (August (3)) (1989) 1238–1244.
architecture. The quantitative relationship between switching time [22] A. Sankarakrishnan, R. Billinton, Sequential Monte Carlo simulation for com-
posite power system reliability analysis with time varying loads, IEEE Trans.
and system EENS is also studied. The results clearly indicate the Power Syst. 10 (August (3)) (1995) 1540–1545.
impact of protection failures on system-wide reliability indices and [23] IEEE Committee Report, IEEE reliability test system, IEEE Trans. Power App. and
also signify the importance of accelerating line switching process. Syst. PAS-98 (November/December (6)) (1979) 2047–2054.
 H. Lei, C. Singh / Electric Power Systems Research 129 (2015) 160–169 169

[24] T.M. Lindquist, L. Bertling, R. Eriksson, Circuit breaker failure data and [31] P. Ferrari, A. Flammini, S. Rinaldi, G. Prytz, Mixing real time Ethernet traffic
reliability modeling, IET Gener. Transm. Distrib. 2 (November (6)) (2008) on the IEC 61850 process bus, Proceedings of the 9th IEEE international work-
813–820. shop on factory communication systems (WFCS), Lemgo, Germany, May 21–24,
[25] M.G. Kanabar, T.S. Sidhu, Reliability and availability analysis of IEC 61850 based 2012, pp. 153–156.
substation communication architectures, Presented at the IEEE power & energy [32] C. Singh, J. Mitra, Monte Carlo simulation for reliability analysis of emergency
society general meeting, Calgary, AB, Canada, 2009. and standby power systems, Proceedings of the 30th IEEE industry applications
[26] V. Skendzic, I. Ender, G. Zweigle, IEC 61850-9-2 process bus and its impact society conference, Orlando, FL, October 1995, pp. 2290–2295.
on power system protection and control reliability, Schweitzer Engineering [33] C. Singh, J. Mitra, Composite system reliability evaluation using state space
Laboratories, Inc., Pullman, WA, USA, Technical Report, 2007. pruning, IEEE Trans. Power Syst. 12 (February (1)) (1997) 471–479.
[27] K.P. Brand, V. Lohmann, W. Wimmer, Substation automation handbook, utility [34] EPRI, Composite system reliability evaluation methods, Final report on research
automation consulting Lohmann, Bremgarten, Switzerland, 2003. project 2473-10, EPRI EL-5178, June 1987.
[28] M.G. Kanabar, T.S. Sidhu, Performance of IEC 61850-9-2 process bus and cor- [35] J. Mitra, C. Singh, Incorporating the DC load flow model in the decomposition-
rective measure for digital relaying, IEEE Trans. Power Del. 26 (April (2)) (2011) simulation method of multi-area reliability evaluation, IEEE Trans. Power Syst.
725–735. 11 (August (3)) (1996) 1245–1254.
[29] L. Andersson, K.-P. Brand, C. Brunner, W. Wimmer, Reliability investigations [36] N. Gubbala, C. Singh, Models and considerations for parallel implementation of
for SA communication architectures based on IEC 61850, Presented at the IEEE Monte Carlo simulation methods for power system reliability evaluation, IEEE
PowerTech, St. Petersburg, Russia, June 2005. Trans. Power Syst. 10 (May (2)) (1995) 779–787.
[30] A. Apostolov, B. Vandiver, IEC 61850 process bus—principles, applications and [37] C.L.T. Borges, D.M. Falcão, Carlos João, O. Mello, A.C.G. Melo, Composite reliabil-
benefits, Proceedings of the 63rd annual conference on protective relay engi- ity evaluation by sequential Monte Carlo simulation on parallel and distributed
neers, 2010, pp. 1–6. processing environments, IEEE Trans. Power Syst. 16 (May (2)) (2001) 203–209.

View publication stats